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AMENDMENTS TO T0F CLAIMS 
Claims 1 - 5. (Cancelled) 

6. (Currently amended) A random function generating apparatus for a data 
encryption device comprising; 

input means for inputting digital signals representing parameter values of each of a 
plurality of functions*** of p com posite functi on rnm ynvA of first and second 
functions of different algeraic structures, and for storing them in storage means; 

candidate function generating means for generating candidate functions eachjrf 
^^idcoinp^ite^ction formed by a combination of saidju^ndsecond pfcsa^ 
functions of different algebraic structures based on said plurality of parameters read out 
of the storage means; 

resistance evaluating means for evaluating the resistance of each of said candidate 
functions to a cryptanalysis; and 

selecting means for selecting those of said resistance-evaluated candidate 
functions which are highly resistant to said cryptanalysis and outputting digital signals 
representing selected ones of said resistance-evaluated candidate functions; 

wherein one of said first and^ econd pkrf^functions of different algebraic 
structures is resistant to each of differential cryptanalysis and linear cryptanalysa. 

7. (Cancelled) 



2 

410094 



PAGE 4/19 * RCVD AT 8/Sf2005 3:08:04 PM [Eastern Daylight Time] * SVR:USPT0£FXRF-G»2 * DNIS:2738300 * CSID:202 293 6229 * DURATION (mm-5S):05-10 



AUG. 5/2005 3:16PM CBL&H 202 293 6229 



NO. 6822 P. 5 



Docket No.: 20162-00547-US 

Application No. 09/463,907 
Amendment dated August 5, 2005 
Reply to Office Action of May 5, 2005 

8. (Currently amended) The random function generating apparatus of claim 6. 
wherein said input means is adapted to input digital signals representing input difference 
values Ax and output mask values ry and storing them in the storage means, and said 
resistance evaluating means comprises at least one of: 

bigher-order-dirTerential cryptanalysis resistance evaluating means for: calculating 
a minimum valueofthe degree ofaBoolean polynomial for input bits by which output 
bits of each of said candidate functions are expressed; and evaluating the resistance of 
said each candidate function to higher order cryptanalysis based on the result of sa>d 

calculation; 

mterpolation-cryptanalysis « sisteMe memS *" eX?reSSiD8 " ^ 

value y as y = «x) for an input value x and a fixed key k using a polynomial over Galoa 
field which is composed of elements equal to a prime p or a power of said pnme p; 

, number of terms of said polynomial; and evaluating the resistance of said each 
candidate function to interpolation cryptanalysis based on the result of satd number; 

partitioning-cryptanalysis resistance evaluating means for: dividing all input 
values of the function to be evaluated and the ^rresponding output values into mput 
subsets and output subsets; calculating an imbalance of the relationships between me 
input subset and the output subset with respect to their average corresponding 
relationship; and evaluating the resisance of said sandjd^funetiontoparationmg 
cryptanalysis based on the result of said calculation; and 

differential-linear cryptanalysis resistance evaluating means for calculating, for 
every set of input difference value Ax and output mask value ry of the function S(x) to 
„c evaluated, a number of input vatoes x for which me toner product of (S<x)W0) 



41Q094 



PAGE 5/19 ' RCVD AT 8/5/2005 3:08:04 PM [Eastern Daylight Time] 1 SVR:USPTO-EFXRF«32 * DNIS:2738300 1 CSID:202 293 6229 1 DURATION (mm<s):05-10 



AUG. 5- "2005 3:16PM CBL&H 202 293 6229 



NO. 6822 P. 6 



Docket No.: 20162-00547-US 

Application No. 09/463,907 
Amendment dated August 5, 2005 
Reply to Office Action of May 5, 2005 

andsaidou^utmaskvalueFVis 1; and evaluating the resistance of said.candidajs 
Junction to differential-linear cryptanalysis based onlae result of add calculation. 

Claims 9 - 12. (Cancelled) 

13. (Currently amended) A random function generating method for data 



enc: 



xyption comprising the Steps of: 

(0 ) inputting digttal signals representing input difference values Ax, output mask 
values ry and paramaer values of each of a plural .Mate functions efdif*"* 
Jmiuuik itnirtun-n r--< storing them in storage means; 

(a) setting various input values read out of me storage means for each of candidate 
Actions S(x) of S-box and calculating output values corresponding to said vanous mpn, 
values x; 

(b) storing the output values in storage means; and 

(c) evaluating the resistanceof each of said candidate Emotions to a cryptanalysis 
ba ,edo„*eouh**valuess^u^ds«oragem 

candidate function highly resistant to said cryptanalysis; and 

wherein said step (c) comprising: 

a higher-order cryptanalysis resistance evaluating step of: calculating 
a minimum value of the degree of a Boolean polynomial for input bi* of each of ^d 
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calculation; and leaving those of said candidate tactions whose resistance is higher than 
a predetermined first reference and discarding the others; 

(c-2) a differential-linear cryptanalysis resistance evaluating step of: 
calculating, for every set of input different value Ax and output mask value Ty of each 
candidate function S(x), a number of input values x for which the inner product of 
(S(x)<-S(x + Ax» and said output mask value I* ta 1; evaluating resistance of said 
caidMae function to differential-linear cryptanalysis based on the result of satd 
calculations and leaving those of said candidate functions whose resisttnce is htgher than 
a predetermined second reference and discarding the others; 

(c-3) a paritioning-cryptanalysis resistance evaluating step of: dividing all 
input values of each candidate taction and the corresponding output values into input 
subsets and output subsets; calculating an imbalance of me rebtionship between the ntput 
subset and the output subset wim respect to their average corresponding retafonsmp; 
evaluating the resistance of said each candidate taction «o laid partitioning crypt* 
based on me result of said calculation; and leaving those of said candidate tactions 
.hose resistance is higher man a predetermined third reference and discarding the omers; 



and 



(t*t) an interpolation-cryptanalysis resistance evaluating step of! 
expressing an output value y as y-400 for an input value x and a fixed key k nsntg a 
polynomial over Galois field which is composed of elements equal to a prune p or a 
power of said prime p; counting a number of terms of said polynomial; evaluating me 
stance of said^andjdate. taction to insolation cryptanalysis; and leavmg mose of 
said candidate tactions whose resist is higher man a predetermined fourth reference 
and discarding the others; 
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wherein said candidate Amotions are each a composite auction composed 
ofJa t M s fS ondj^^ 

second tactioifcbemg resistant * said differential cryptanalysis and | 

^alysis^ea*^*^^ 

at loost ono functio n- 

14. (Currently amended) The random junction generating method of claim 13, 

wherein: 

said diflerennal-linear-cryptanalysis resistance evaluating «ep (c-2) includes a 
m of; calculating the foUowing eauation for every se, of said input difference value Ax 
except 0 and said output mask value Ty except 0 

^ s (Ax,rv)=|2x#{xeGF(2)»|(S(x) + S(x + Ax)).ry = l}-2i; 

bating a maximum value S among the osculation result and eva.ua.ing me 
^ceofsaidcandidatefunction^said dBft--««W«-«»*»---- 4 

maximum value 3; and 

said partitioning cryptanalysis resistance evaluating step (3) includes a step of 
dividing an input value set F and an output value set O of said,candjSate. function into u 

TLJf F FaandvoutputsubseMOcG, G.,>; for each partition- 

rr cifl-0 u-l j^O^.-.-.v-lXcalculatingamaximumoneofprobab^es 

pair^GOCi 0,..,ul,j , fftalHnoutva iaesxofthe input subset^ belong to 
thatalloutputvaluesycorresponduigtoallinputvaluesxotui 

« . n _ a calculating a measure I S (F, <j) 01 an 

the respective output subsets Gj 0-0, V-U,caicui e ^tfor 

. • /i7 /-\ K aE ^ nn all maximum values calculated tor 
average imbalance of a partition-pair (F, G) based on all maximum 
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an partition pairs; and equating the resist of *i candidate function to said 

partitioning cryptanalysis based on said measure. 

,5. (Original) The random function generating method of claim 13 or 14. herein, 
saidstepCc-Omctadesastepofiwhennocar^dateftmcuonr.mains 

process; 

*id step (c-2) includes a step of ^hen no candidate function 

selecting process; 

^discarded, easingthe candidate Action selecting condition by 

reference by a third predeternuned width, and executing again the evaluate and 

selecting process; and 

said step (c-4) includes a step of: .hen no candidate function remains 
undiscarded. easing the caudate function selecting condition by changmg satdfouru, 

selecting process. 

,6. (Previously presented) The random function generating method of daim 13 or 
14, further comprising: 
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(o-5) a amMM*** » ™»»** ** ° £ ***** * "* 

c^date function S(x), *e number of inputs x that satisfy «fr S(x + Ax)=Ay for every 
» (Ax, Ay) except Ax-O; evaluating the resist of said each Candida* Action to 

discarding the oflieis before said step (o-2). and 

(*) a Imear-cryptanalysis resist evaluating s* P of: calculating, for each 

the others after said step (c-5). 

17. (Cancelled) 

1 8. (Previous* presented) The random function generating n^od of claim 16, 



wherein: 



sai ds^(c-5)telude S a^ofiwhennocandidatefunctionren M u,s 
rferencebyamprede^vvidd.^executingagata 



selecting process; and 



sai d step (c-6) indudes a step of. whenno candidate «*°*°^ 
discarded, easutg the candidate function selecting condition by changutg satd srxth 
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reference by a sixth preceded and executing again the evalnation and 
selecting process. 

^(represented) l*^^"^^*^! 
wtere in S aid candidate tactions - each » composite taction composed f a U- - 

ri^onofan^aic^d^^^ofsatdatie^one 

function. 

fraction generating metad for data encrypnon as a computer program, said program 

comprising the steps of: 

a , narameter for candidate functions S(x) and 

(a) setting various values as each parameter ior can 

calculating output values corresponding to various input values; 

(b) storing the output values in storage means; and 

candidate function highly resistant to said cryptanalysis; and 
wherein said step (c) comprises: 
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a predetermined first reference and discarding the others; 

(c-2) a differential-linear cryptanalysis resistance evaluating step of: 
calculi *r ev«y set of input difference value * and output mas, vaiue ry of each 

(S(x)W0) and «W ^ is 1; evaluating resistance of sad 

apredetenrinedseeondreferenee and discardingthe others; 

(c -3) . partitiorung-crypfcnalysis distance evaluating step of: dividing all 



and 



(c-4) an interpolation-cryptanalysis resistance evaluating step of: 

!TZl over Galois field which is composed of element euual « » pnme p or a 
polynomial over oaiois polynomial; evaluating the 

said candidate functions whose resistance is higher man P 
and discarding the others; 
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herein said candidate factions are eaeh a composite taction composed 

^d functiotaiSfflg resistant to said differential cryptanalysis and sard «--^ 

secpnoiunv i ,i„„! f Ttnm mi ad iffl ifiii t fl il ~">f ™"l 

cryptaualysi Wu l l u . u l uui ItarUnn nf mi tiffbew ^ 

jU i uutt u uo f jin nt in n . 

21. (Currently amended) The recording medium of claim 20, whe«in: 

said diffeential-linear-cryp^nalysis resistance evaluating step (c-2) includes a 

0 and said output mask value ry except 0 

^(Ax,r>)=|2x#{*eGF(2) fl |(S(x) + S^+Ax))»ry = l}-2-|; 

maximum value 3; and 

saldparUuonmgcrvp^alysisresistance evaluating step C^lud* asteptf 

oMding . input value set F and an output value set G of said^nd^ function mto u 
Oiviaing <ui mp«v A- for each partition- 

t. * rtr v V a and v output subsets (G 0 , Gi, ...,wihi° rcavw i' 
input subsets {F 0 , Fi, ...,l*u-ii ana vuu ^ wft habilities 

, • » a i v-n calculating a maximum one of prooaDiiraes 

1. • n /; - n v-1 V calculating a measure 1 S (F, G) oi an 
the respective output subsets Gj (j "°> ■•" v 1J ' cmcw B , . w ^ fnr 

partitioning cryptanalysis based on said measure. 
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22. (Original) The recording medium of claim 20 or 21, wherein: 

said step (c-1) includes a step of: when no candidate function remains 
discarded, easing me candidate function selecting condition by changing said first 
Terence by a first predetermined width, and executing again the evaluaUon and selectmg 

process; 

sdd ste p(c. 2 )include 3 a^of : «he nn ocandida«funcU<mr lil n«i M 

discarded, easing the candid tart. selecting — * ^ 
referenceby . second predetermined width, and executing again the —on and 

selecting process; 

said step (c-3) inCudes a step of: when no Candida* function remains 
undiscardeu, easing the candidate function Meeting condition by changmg sa.d m.rd 
reference byatltirdpredetermmeu width, and executing agam me evaluauon and 

selecting process; and 

^(c^mc^eaastepofiwhenno^ _ 

selecting process. 

«. (Previously presented) Th. recording medium of claim 20 or 21, wherein said 
program includes at least one of: 

( ^ 5) adi^al^ryptanaiysisresistance evaluating step of: calculating for 
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m candid functions whose resistance is higher man a predetemuned fifth reference 
and disearding the others before said step (c-2); and 

M ) a Imear-cryT^nalysis resistance evaluating step of: caiculating, for each 
vaiue X and its mask vahte ft is eoual to the inner product of a taction output vah* S(x) 

the others after step (c-5). 

24. (Cancelled) 

25. (Previously presented) The recording medium of claim 23, wherein; 
said step (c-5) includes a step of. when no candidate taction — 

Terence by a fifth predetermined width, and executing again «• «— - 

selecting process; and 

.aid step (c-6) indndes a ^ of: when no Candida* taction remain 

t eference by a six* predeKnnined widm, and executing agam the evaluauon and 

selecting process. 

26 (Previously Presented) The recording medium of claim 21, wherein said 
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resist, to said differential cryptanalysis and said linear cryptanalysis and at least one 
taction of an algebraic structure different from that of said at least one function. 

Claims 27 - 30. (Cancelled) 

31 (Previously presented) The random function generating method of data 15, 
w herein said candidate functions are each a composite function composed of at least one 
taction resistant * said difierenual cryptanalysis and said linear cryptanalysis and at 
leas, one function of an algebraic structure different from th* of said at least one 

function. 

32 (Previously presented) The recording medium of 22, herein said candidate 
functions are each a composite Action compost of at least one function resistant to 
saiddifferential cryptanalysis and said Une^ cryptanalysis and at least one funcuon of an 
algebraic structure different from that of said at least one function. 

Claims 33 - 38 arc cancelled. 
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